Skip to main content
CPEBuddy
DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci

DCSG1 - Augmenting Apple's Source Code and OS Logs with AI Agents -Olivia Gallucci

Source: YouTube · DEFCONConference · published Sep 30, 2026 · 19:49

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Olivia Gluchi (Datadog) presents an AI-augmented macOS vulnerability research workflow that treats Apple's partial open-source releases, binaries, and unified logs as "sensors" feeding an agent pipeline that produces a prioritized, evidence-backed research queue 0:14.

Key Takeaways:
• Her tool OSS Sensor generates a prioritized queue from Apple OSS diffs, binary features, and log templates via rule-based scoring — a triage aid, not automated vuln discovery, with AI and non-AI versions 0:14.
• Apple's 400+ public repos are incomplete/outdated, but partial source is a "map" — landmarks are real — correlatable with proprietary binaries via strings, otool, nm, and class-dump 3:13.
• Binary diffing reveals patch logic: the 2016 syslog diff (value+4 → value×4+4) exposed a heap-overflow mitigation; unpatched twin files may remain vulnerable 6:59.
• The pipeline uses a retriever, deterministic analyzers, and specialized agents; the model is a "junior engineer," not a god — humans own exploitability 9:16.
• Unified logging is high-ROI: subsystem/category labels and stable strings reveal which components handle input and which error paths fire, also feeding detection engineering 10:56.
• The AI fuzz planner proposes candidate surfaces, harness scaffolds, seed strategies, and success metrics — full exploit chains remain where the workflow breaks down 12:52.

The core message is the philosophy of diff → hypothesis → harness: evidence-backed, provenance-tracked triage that makes macOS vulnerability research more scalable, teachable, and accessible 16:59.

Sources:

  • 0:14 OSS Sensor overview and triage-only scope
  • 3:13 Apple's incomplete open-source surface
  • 6:59 Syslog binary diffing example
  • 9:16 Agent pipeline architecture
  • 10:56 Unified logging as attack-surface pivot
  • 12:52 Fuzz planner capabilities and limits
  • 16:59 Closing philosophy and outcomes

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

here. Cool. Okay. Um, all right. Hi everyone. Thank you so much for having me. My name is Olivia Gluchi and I work at Data Dog. Today I want to show an AI workflow for Mac OS vulnerability research. So before I begin, I want to mention a tool I published called OSS Sensor. OSS sensor generates a prioritized evidencebacked research queue derived from Apple OSS Diffs basic binary features and log templates. It applies custom rule-based scoring and reporting to support triage. The binary and log analysis components are intentionally lightweight and there's no integrated LLM or vulnerability verification. It's designed as a triage and hypothesis generation aid, not as a automated vulnerability discovery or exploitation tool. There are currently two versions of this project available, one witho…